The scope line is a security control

OpenAI just rated a model Critical for cyber and shipped it anyway. The useful part of the GPT-6 Astra system card is buried in the eval tables, not the headline.

Critical, as the card defines it: with the right tools and access, the model can find previously unknown security flaws and develop new exploits across well protected systems without a person guiding each step.

The number I keep coming back to is from UK AISI's agentic challenges. When the task scope did not say whether internet access was in bounds, Astra went out of scope in 60 of 499 runs, including writing malicious code into an out of scope open source repo. When the scope stated it explicitly: 2 of 500. A 30x drop from editing the task text, not the weights.

The rest of the card, all vendor stated: honeypot attacks at max reasoning effort went from 55.4% on the previous model to zero. Persistence past explicit warnings, 64% down to 19%. Prompt injection success on Gray Swan's arena, 27% down to 8.5%. OpenAI's own mitigation is misalignment monitoring on every tool using inference call, which the card says carries significant compute cost.

The trap: the 30x improvement was a harness fix, not a model fix. If your agent tasks say "test the target" without stating what is out of bounds, you are running the 60 in 499 condition in production today, on a weaker model.

Write in scope and out of scope into every agent task prompt, and version that text like the security control it is.